To use Claude Code with Amazon Bedrock, first enable access to the Anthropic model in your AWS account, then authenticate Claude Code with AWS credentials, enable Bedrock mode, choose a region and model route your account can invoke, and grant the required IAM permissions. AWS authentication is separate from Claude Code login: in Bedrock mode, Claude Code uses the AWS SDK default credential chain.
The steps below distinguish the guided setup for a developer workstation from environment-based configuration for CI or managed deployments. Model availability and identifiers can vary by account and region, so confirm the route in your own AWS environment.
As an Amazon Associate I earn from qualifying purchases.
How to Set Up AWS Credentials and IAM Permissions for Claude Code on Bedrock
Use this order: enable model access, confirm the AWS identity, configure Claude Code to use Bedrock, select a working region and model route, grant IAM access, and test. The Claude Code on Amazon Bedrock guide is the product-specific reference for setup and configuration; AWS’s identity-based policy examples for Amazon Bedrock explain the broader IAM policy context.
1. Enable Anthropic model access in Bedrock
Before Claude Code’s first model invocation, open the Amazon Bedrock model catalog, select the Anthropic model you intend to use, and submit the use-case form. The Claude Code guide describes access as granted after submission. Access to a model is account-level preparation; it does not replace the IAM permissions or AWS credentials needed for requests.
#1 Best Overall
For an AWS Organizations deployment, the guide says the management account can submit through PutUseCaseForModelAccess. That operation requires its corresponding IAM permission, and approval extends to member accounts. Follow your organization’s approval process and confirm the intended model is available to the account and region you will use.
2. Choose guided setup or manual configuration
| Setup path | Best fit | What it configures |
|---|---|---|
| Interactive setup assistant | A local developer workstation | Prompts for an AWS credential source and region, checks model invocation access, and lets you pin models; saves settings in the user settings file. |
| Manual environment setup | CI, scripts, or managed deployments | Enables Bedrock through environment configuration and lets the deployment supply credentials and any needed region or endpoint override. |
Run the interactive assistant
- Start Claude Code with
claude. At the authentication prompt, choose the third-party platform option and then Amazon Bedrock. - Follow the prompts to select a detected AWS profile, a Bedrock API key, access and secret keys, or credentials already present in the environment. Choose the intended AWS region.
- Let the assistant check invocation access, then pin the model choices you want Claude Code to use.
If Claude Code is already open, run /setup-bedrock to start the setup flow from the session.
Configure a scripted or enterprise deployment
Set CLAUDE_CODE_USE_BEDROCK=1 in the environment used to launch Claude Code. Supply AWS credentials through the AWS SDK credential chain rather than committing temporary secrets to source-controlled configuration. Set a region override only when needed, and use the documented Bedrock endpoint override when routing through a custom endpoint or gateway. The exact environment and secret-injection mechanism should follow your organization’s deployment policy.
3. Configure and verify AWS credentials
Claude Code uses the AWS SDK default credential chain. Documented options include credentials configured with the AWS CLI, environment credentials, an AWS SSO profile, credentials already supplied in the environment, and Bedrock API keys. Use the method approved for your environment; do not treat Claude Code login as a substitute for an AWS identity.
Use an AWS SSO profile
- Authenticate the profile with
aws sso login --profile=PROFILE_NAME, replacingPROFILE_NAMEwith the configured profile name. - Set
AWS_PROFILE=PROFILE_NAMEin the shell or process environment that launches Claude Code. - Check which AWS identity the credentials resolve to by running
aws sts get-caller-identityin that same environment.
Confirm the returned principal and account are the intended ones before invoking a model. For other credential methods, apply the same identity check where the AWS CLI can use those credentials. In Bedrock mode, AWS credentials handle authentication, so Claude Code’s /logout command is unavailable and is not the way to change AWS credentials; switch the AWS profile, environment, or credential source instead.
4. Set the region and choose a model route
When no explicit region override is set, the current Claude Code guide resolves the region in this order: AWS_REGION, AWS_DEFAULT_REGION, the active AWS profile’s region, then us-east-1. The active profile is the one named by AWS_PROFILE, or default if that variable is unset. In a Claude Code session, run /status to see the resolved region.
Bedrock model availability depends on the account and region. Check that the model or inference profile you intend to call is currently available to your account in the selected region; do not assume a model ID or default shown in an example is permanent.
Base model ID versus inference profile
A base model ID identifies a foundation model. An inference-profile ID or ARN identifies a profile route that can be required for a model or throughput type. Some requests fail if sent to a base model that does not support on-demand throughput; in that case, use the appropriate inference profile ID or ARN for your account and region.
Best Value
For a team rollout, pin explicit model versions rather than relying on aliases to decide when all users move to a newer version. Choose profile and model resources deliberately so the model route stays consistent with the IAM policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.5. Grant the IAM permissions Claude Code needs
The Claude Code policy example includes permissions for invocation, response streaming, and inference-profile discovery and lookup. Use it as a starting point to adapt to the models and profiles your deployment actually uses, not as a universal least-privilege policy.
| Action | Why it appears in the Claude Code example |
|---|---|
bedrock:InvokeModel |
Invoke a model. |
bedrock:InvokeModelWithResponseStream |
Invoke a model with response streaming. |
bedrock:ListInferenceProfiles |
Discover inference profiles. |
bedrock:GetInferenceProfile |
Look up an inference profile. This helps Claude Code resolve an application inference profile ARN to its backing foundation model and choose the request shape; without it, Claude Code may retry with an alternative request shape, adding a round trip. |
The example’s resources cover inference-profile, application-inference-profile, and foundation-model ARN patterns. Narrow those resources to the specific inference-profile and model ARNs your deployment needs where practical. The example also includes aws-marketplace:ViewSubscriptions and aws-marketplace:Subscribe, conditionally limited to calls made through bedrock.amazonaws.com. Include or adjust those actions only as required by your access path and organization’s policy. Review the complete current policy example in the Claude Code Bedrock guide and compare it with AWS’s Bedrock identity-based policy examples.
Quick Recap
6. Verify the setup and troubleshoot common failures
- Authentication fails: Check that the intended profile is selected, its SSO session or other credentials are active, and Claude Code inherits the expected environment.
- The request reaches the wrong region or the model is unavailable: Run
/statusand compare its resolved region with the region where your account can use the model or profile. - A base model reports unsupported on-demand throughput: Use an appropriate inference-profile ID or ARN instead of sending the request to that base model route.
- Model or throughput errors persist: Query the inference-profile list in the selected region and confirm the chosen profile is available to the account.
- A team deployment behaves inconsistently: Pin explicit model versions and scope IAM resources to the profiles and models the deployment is meant to use.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
